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Remarks 



This Application has been carefully reviewed in light of the Final Office Action 
("Office Action") mailed electronically on February 22, 2008. Applicant appreciates the 
Examiner's consideration of the Application. Claims 1-24 remain pending. Applicant 
respectfully requests reconsideration and allowance of all pending claims. 

Claim Objections 

The Examiner objects to the use of the phrase "being operable to" in Claim 19. 
However, the Examiner provides no support in case law or statutes to suggest that use of the 
phrase "being operable to" is an appropriate ground for objection. Applicant respectfully 
contends that use of the phrase "being operable to" is proper. Furthermore, an informal 
search of the USPTO's website returns over 150,000 issued patents with claims reciting the 
phrases "operable to" or "being operable to." In short, use of the phrase "operable to" in 
claims is a practice that is both well accepted and currently supported by the PTO. To the 
extent that the Examiner intends to maintain this objection, Applicant respectfully requests 
the Examiner to provide support from applicable authority, such as case law or statutes. 

Rejections under 35 U.S.C. § 103 

The Examiner rejects Claims 1-2, 4-5, 7-8, 10-11, 13-14, 16-17, 19-20, and 22-23 
under 35 U.S.C. § 103(a) as being unpatentable over Vaidya. Applicant respectfully traverses 
these rejections for the reasons discussed below. 

In order to establish a prima facie case of obviousness of a claimed invention, all 
claim limitations must be taught or suggested by the prior art. See M.P.E.P. § 2143. 

Claim 1 recites: 



A method for maintaining security of a computer system, comprising: 
determining an initial system certainty value for the computer system; 
providing access to a database of signatures, each signature including a 
signature certainty value; 
receiving data; 

comparing the received data with the database of signatures; 

increasing the system certainty value if the received data does not 
match a signature in the database; 

decreasing the system certainty value if the received data matches a 
signature in the database; and 
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filtering the data based on the system certainty value and the signature 
certainty value of a signature matching the received data. 

Vaidya discloses a "signature inspection-based network intrusion detection system." 
Vaidya, col. 2, lines 62-63. When data is addressed to a network object, an attack signature 
profile is processed to determine if the data is associated with a network intrusion. Vaidya, 
col. 3, lines 39-47. Although various types of attack signature profiles may be used, the 
Examiner focuses on the use of a "timer/counter based attack signature profile." Office 
Action, pg. 5. Under this profile, if "an event has occurred a threshold number of times 
within a predetermined time interval . . . [then] a network intrusion has been detected." 
Vaidya, col. 8, lines 16-21, 36-38. Applicant respectfully submits that Vaidya fails to 
disclose, teach, or suggest each and every element of Claim 1. 

For example, Applicant respectfully contends that Vaidya fails to disclose or suggest 
"increasing the system certainty value if the received data does not match a signature in the 
database" or "decreasing the system certainty value if the received data matches a signature 
in the database." The Examiner admits that Vaidya fails to explicitly disclose these 
limitations. Office Action, pg. 4. Instead, the Examiner claims that the timer/counter based 
attack signature profile of Vaidya suggests these limitations "for the purposes of determining 
whether a particular event has occurred a threshold number of times." Office Action, pg. 5. 
Applicant traverses this statement and respectfully contends that the Examiner is 
mischaracterizing the limitations of Claim 1. Claim 1 encompasses either " increasing the 
system certainty value" or " decreasing the system certainty value" depending on the received 
data. This does not merely determine whether a particular event has occurred a threshold 
number of times. 

Furthermore, the Examiner states that, in Vaidya, "it is suggested that the threshold 
may be set/selected accordingly, which provides suggestion to it being adjustable (i.e. 
increased/decreased)." Office Action, pg. 9 (emphasis added). Applicant respectfully points 
out that Vaidya discloses a "preselected threshold." Vaidya, col. 4, line 26 (emphasis added). 
Applicant respectfully contends that this preselection fails to disclose, teach, or suggest the 
threshold being adjustable after comparing the received data with a database of signatures. 
Additionally, when the timer/counter attack signature profile is used, Vaidya discloses that no 
action is taken when an incoming expression fails to match the signature. See Vaidya, col. 
12, lines 23-26. Applicant respectfully contends that the Examiner's use of suggestions 
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within suggestions appears to be reliance on hindsight to recreate the limitations of Claim 1 . 
"However, impermissible hindsight must be avoided and the legal conclusion must be 
reached on the basis of the facts gleaned from the prior art." M.P.E.P. § 2142. For at least 
these reasons, Applicant respectfully contends that Vaidya fails to disclose, teach, or suggest 
each and every limitation of Claim 1 . 

Claims 2, 4, and 5 depend from Claim 1 and incorporate all the limitations thereof. 
As such, Applicant respectfully requests that the rejections of Claims 1, 2, 4, and 5 be 
withdrawn. 

Similar to Claim 1, Claims 7, 13, and 19 include elements directed to "increasing the 
system certainty value if the received data does not match a signature in the database" and 
"decreasing the system certainty value if the received data matches a signature in the 
database." Thus, for at least the reasons discussed above with regard to Claim 1, Applicant 
respectfully submits that the rejections of Claims 7, 13, and 19 are improper. Claims 8, 10, 
and 11 depend from Claim 7 and incorporate all the limitations thereof. Claims 14, 16, and 
17 depend from Claim 13 and incorporate all the limitations thereof. Claims 20, 22, and 23 
depend from new Claim 19 and incorporate all the limitations thereof. As such, Applicant 
respectfully requests that the rejections of Claims 7-8, 10-11, 13-14, 16-17, 20, and 22-23 be 
withdrawn. 

The Examiner rejects Claims 3, 6, 9, 11, 15, 18, 21, and 24 under 35 U.S.C. § 103(a) 
as being unpatentable over Vaidya in view of Moran. Applicant respectfully traverses these 
rejections for the reasons discussed below. 

Claims 3 and 6 depend from Claim 1, and incorporate all the limitations thereof. 
Claims 9 and 1 1 depend from Claim 7 and incorporate all the limitations thereof. Claims 15 
and 18 depend from Claim 13 and incorporate all the limitations thereof. Claims 21 and 24 
depend from Claim 19 and incorporate all the limitations thereof. As discussed above, 
Vaidya fails to teach all of the elements of Claims 1, 7, 13, and 19. Moran fails to overcome 
these deficiencies. Therefore, Applicant respectfully requests that the rejections of Claims 3, 
6, 9, 11, 15, 18, 21, and 24 be withdrawn for at least the same reasons as discussed above 
with regard to their respective base claims. 
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No Waiver 

All of Applicant's arguments and amendments are without prejudice or disclaimer. 
Additionally, Applicant has merely discussed example distinctions from the Vaidya and 
Moran references. Other distinctions may exist, and Applicant reserves the right to discuss 
these additional distinctions in a later Response or on Appeal, if appropriate. By not 
responding to additional statements made by the Examiner, Applicant does not acquiesce to 
the Examiner's additional statements. The example distinctions discussed by Applicant are 
sufficient to overcome the obviousness rejections. 
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CONCLUSION 



Applicant has made an earnest attempt to place this case in condition for allowance. 
For the foregoing reasons, and for other apparent reasons, Applicant respectfully requests full 
allowance of all pending claims. 

Applicant believes that no fee is due. However, the Commissioner is hereby 
authorized to charge any fee or credit any overpayment to Deposit Account No. 02-0384 of 
BAKER BOTTS L.L.P. 

If the Examiner believes a telephone conference would advance prosecution of this 
case in any way, the Examiner is invited to contact Luke K. Pedersen, Attorney for 
Applicant, at the Examiner's convenience at (214) 953-6655. 




Respectfully submitted, 

BAKER BOTTS L.L.P. 
Ajjmmmy^for Applicant 



Luke K. Pedersen 
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